EUVD-2026-15093
GHSA-v2rp-wxm3-8hxp
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V15 - Secure Coding and Architecture Bounds checking, write limits
MITRE ATT&CK
2 techniques across 2 tactics: Execution, Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The real-world risk of this vulnerability is elevated despite the absence of published CVSS and EPSS scores. The vulnerability enables file system modification of protected areas, which represents high technical impact (potential system compromise, privilege escalation, or denial of service). The attack vector appears to require local application execution, suggesting medium attack complexity and limited attack surface compared to network-based vulnerabilities. The fact that Apple has issued patches across three major OS versions indicates the vendor assessed this as a priority security issue requiring urgent remediation. Without public KEV status or POC data, the exploitation likelihood is uncertain, but the patch availability and multi-version scope suggest this warrants prioritization for organizational patching cycles. |
| Exploit ScenarioDerived | A malicious application could exploit this out-of-bounds write vulnerability by crafting specially constructed file system operations that trigger insufficient bounds checking in the kernel or system libraries. Upon execution, the application could write crafted data beyond allocated buffer boundaries, overwriting protected file system metadata, kernel data structures, or other sensitive system resources. This could allow the attacker to escalate privileges, disable security mechanisms, or cause system instability without requiring additional system-level permissions. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 25, 2026
Improper bounds checking in Apple macOS (Sequoia 15.7.4 and earlier, Sonoma 14.8.4 and earlier, Tahoe 26.3 and earlier) permits a local attacker to write out-of-bounds memory through a malicious application, potentially allowing modification of protected filesystem areas. The vulnerability requires user interaction to execute the malicious app and affects the file system's integrity rather than confidentiality. No patch is currently available for this out-of-bounds write condition.
Earlier versions of this analysis (1)
An out-of-bounds write vulnerability in macOS allows applications to modify protected parts of the file system by exploiting insufficient bounds checking. This vulnerability affects macOS Sequoia, Sonoma, and Tahoe across multiple versions, potentially allowing a malicious or compromised application to escalate privileges and corrupt system files. While CVSS and EPSS metrics are not publicly available, the vulnerability has been patched by Apple, indicating active development effort to address the threat.
RemediationAI
Immediately upgrade affected macOS systems to the patched versions: macOS Sequoia 15.7.5 or later, macOS Sonoma 14.8.5 or later, or macOS Tahoe 26.4 or later. Consult Apple's security advisories at https://support.apple.com/en-us/126794, https://support.apple.com/en-us/126795, and https://support.apple.com/en-us/126796 for detailed patching instructions. Until patching can be completed, restrict execution of untrusted applications through Gatekeeper enforcement and Security & Privacy settings, monitor file system access logs for unusual write activity to protected directories, and maintain current backups of critical system files.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
This vulnerability is classified as a buffer overflow or out-of-bounds write issue (related to CWE categories concerning memory safety) affecting Apple's macOS operating system across multiple major versions. The affected products span macOS Sequoia (15.x), macOS Sonoma (14.x), and macOS Tahoe (26.x) as indicated by CPE cpe:2.3:a:apple:macos:*:*:*:*:*:*:*:*. The root cause involves inadequate bounds checking in code that interacts with the file system, allowing an application with access to certain APIs to write beyond allocated buffer boundaries and corrupt protected file system regions. This type of memory safety issue typically enables attackers to escape application sandboxing or overwrite critical system structures.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in macOS Sequoia 15.7.5, macOS Sonoma 14.8.5, macOS Tahoe 26.4. An app may be able to modify protected parts of the file system.
Executive ViewAI
Organizations using An out-of-bounds write should be aware of moderate risk from CVE-2026-28825, a out-of-bounds write vulnerability rated CVSS 5.5. Exploitation could cause memory corruption or application crashes. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: enable ASLR/DEP, apply network segmentation.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
A buffer overflow occurs when a program writes more data to a memory buffer than it was allocated to hold, causing the excess data to spill into adjacent memory regions.
Memory corruption occurs when a program writes data beyond the boundaries of allocated memory regions or accesses memory in unintended ways, violating the integrity of the process's address space.
Exploit-DB